Making Life Simpler for DevOps with Security Practices
May 04, 2016

Anirban Banerjee
Onion ID

The next breach inside enterprises is expected to come from within. Many articles have been written about Insider Threats, the origination points, motivation, detection, DLP and more. I have talked to many an enterprise to understand the strategies and policies that are employed to manage this threat.

Privilege Management is a new age term, born from the crucible of Role Based Access Control (RBAC). Privilege Management refers to the ability of any enterprise to successfully manage, detect and mitigate any possibility of employee account misuse. The definition is quite terse and a bit wishful. In reality most organizations have very poor privilege management practices employed for their resources. In this blog, I will discuss why that is the case, what are some good strategies to launch effective privilege management in your organization and some of the gotchas that you can avoid.

The Many Faces of DevOps

Lets accept a fact: DevOps plays a multitude of roles inside most organizations. It is no longer: “Let's make sure our DNS stays up all the time.” It is: “Let's make sure our DNS stays up all the time and that we are DDoS resistant.”

Feel free to tag on a couple of more statements dealing with enhancing the security of the previously mentioned DNS system. The point is that DevOps is evolving at a breakneck speed and more enterprises are putting jobs on a DevOps person's plate than they can reasonably take off it.

The Pain Point

One of the constant thorns in the side is security. As if it's not hard enough to keep things running at web scale. It's great to read articles on hacker news about how you can use nodejs to power millions of requests a second without breaking a sweat. In reality though things are far from rosy. It's a lot of hard work, long nights, group huddles that get things to work, and, work with a good degree of reliability.

In this blog, I am going to talk about how a lot of DevOps teams are managing security practices and what can be done to reduce the amount of time spent on each aspect yet up the amount of security that you can actually eek out of the system.

Why Existing Tools Don't Alleviate the Pain

Using configuration management systems ensures that DevOps does not spend time on making sure the base OS images, packages and software on servers that make up a cluster are uniform and adhere to a common set of security guidelines.

Even though the tools mentioned above are very effective in providing network visibility they do not help DevOps when the proverbial (expletive deleted) hits the fan from a compliance perspective.

Consider the case where an employee account is misused to perform some actions that are not in compliance with a company's policies. In this case, using configuration management systems helps only to the effect that you can find out if someone accessed an account, when and possibly which server were affected. However if the employee is smart enough and tries to cover their tracks by wiping history, logs etc. it's a rabbit hole that DevOps and security teams have to now jump into.

This is a case of misalignment of expectations from a DevOps group. Unfortunately this happens more often than not because DevOps handles the heartbeat of any product and so is called in time and again to help with various teams like security.

Simple Fixes

To make life simpler for DevOps here are some high level tool category suggestions that will save time and headaches when push comes to shove:

1. Install and use a SSH key rotation system: This will help in keeping compliance reviews short and prevent attackers from causing massive damage.

2. Install and use a SSH session recording system: This helps in making sure that if ever a request comes in to analyze whether someone performed a specific action, DevOps does not have to spend a ton of time investigating issues.

3. Use an inventory management system for all your infrastructure: Something akin to security monkey for AWS. This helps you keep tabs on what you really see in the configuration management system is actually what is on your cloud IaaS account or not.

4. Use a blacklist of commands: Mistakes happen often in life and people often make costly mistakes. Don't let someone type rm -rf* on your production cluster by mistake.

I discussed the high level rationale for why a DevOps job is not easy. I followed that up with some concrete product areas that will help make life simpler and less hectic for everyone.

Dr. Anirban Banerjee is CEO of Onion ID.

Share this

Industry News

July 08, 2025

BrowserStack announced the launch of BrowserStack AI, a suite of AI agents integrated throughout the testing lifecycle to help software teams accelerate release cycles, improve test coverage, and boost productivity by up to 50%.

July 08, 2025

Coder introduced a major platform upgrade designed specifically for enterprise teams working with AI coding agents.

July 08, 2025

LambdaTest has announced the release of SmartUI’s Smart Branching and Baseline Management.

July 08, 2025

Lens by Mirantis announced the availability of Lens Prism, a fully-integrated, production-grade artificial intelligence (AI) assistant embedded directly within the Lens integrated development environment (IDE).

July 08, 2025

vFunction announced GenAI-powered capabilities to refactor and rearchitect applications.

July 08, 2025

Payara announced a strategic partnership to help enterprises modernize their Java applications with a codeless, lift-and-shift migration solution, reducing infrastructure and cloud costs and boosting performance and scalability.

June 26, 2025

Backslash introduced a new, free resource for vibe coders, developers and security teams - the Backslash MCP Server Security Hub.

June 26, 2025

Google's Gemma 3n is the latest member of Google's family of open models. Google is announcing that Gemma 3n is now fully available for developers with the full feature set including supporting image, audio, video and text.

June 26, 2025

Google announced that Imagen 4, its latest text-to-image model, is now available in paid preview in Google AI Studio and the Gemini API.

June 26, 2025

Payara announced the launch of Payara Qube, a fully automated, zero-maintenance platform designed to revolutionize enterprise Java deployment.

June 25, 2025

Google released its new AI-first Colab to all users, following a successful early access period that had a very positive response from the developer community.

June 25, 2025

Salesforce announced new MuleSoft AI capabilities that enable organizations to build a foundation for secure, scalable AI agent orchestration.

June 25, 2025

Harness announced the General Availability (GA) of Harness AI Test Automation – an AI-native, end-to-end test automation solution, that's fully integrated across the entire CI/CD pipeline, built to meet the speed, scale, and resilience demanded by modern DevOps.

With AI Test Automation, Harness is transforming the software delivery landscape by eliminating the bottlenecks of manual and brittle testing and empowering teams to deliver quality software faster than ever before.

June 25, 2025

Wunderkind announced the release of Build with Wunderkind — an API-first integration suite designed to meet brands and developers where they are.

June 25, 2025

Jitterbit announced the global expansion of its partner program and new Jitterbit University partner curricula.